CVE-2026-54686: Warp Terminal Information Disclosure Flaw

CVE-2026-54686 Overview

CVE-2026-54686 affects Warp, an agentic development environment that integrates AI assistance into a terminal. Warp accepted state-mutating terminal lifecycle hooks from the pseudoterminal (PTY) stream without verifying that the hooks originated from Warp's shell integration for the active session. An attacker who tricks a victim into viewing attacker-controlled terminal output can spoof lifecycle metadata. Spoofable values include the current working directory reported for the active block and SSH session transport metadata. The flaw exists in versions from 0.2021.04.25.23.05.stable_00 up to 0.2026.05.06.15.42.stable_01, where it is fixed. The weakness is classified under [CWE-78].

Critical Impact
Attackers can spoof working directory and SSH transport metadata in Warp blocks, misleading users about the trust context of commands they execute.

Affected Products

Warp terminal versions 0.2021.04.25.23.05.stable_00 through 0.2026.05.06.15.42.stable_01 (exclusive of fix)
Warp shell integration components for Bash subshells and login shells
Warp ANSI/DCS hook handler in app/src/terminal/model/ansi/

Discovery Timeline

2026-06-24 - CVE-2026-54686 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-54686

Vulnerability Analysis

Warp uses Device Control String (DCS) escape sequences to receive lifecycle hooks from its shell integration. These hooks report events such as InitShell, CommandFinished, and working directory changes. The terminal parses any DCS-formatted hook arriving on the PTY stream and applies the state changes to the active block. Because the handler did not validate the hook origin, any program that wrote DCS sequences to the terminal could impersonate the shell integration. The result is a user interface deception: the block UI reflects state that an attacker chose, not the real shell state.

Root Cause

The root cause is missing integrity validation on inbound DCS hooks. Warp's shell init scripts generated a WARP_SESSION_ID locally using date and $RANDOM, then emitted it inside hook payloads. The terminal never required hooks to carry a session identifier that it had registered for the active PTY. Any process writing to the same TTY could craft hook messages and have them accepted as authentic shell integration events.

Attack Vector

Exploitation requires the victim to view attacker-controlled output in a Warp session. Typical vectors include cat of a malicious file, curl of a hostile URL, viewing remote logs, or SSH into a compromised host. The attacker emits DCS-encoded hook payloads that mutate Warp's view of the current working directory or SSH transport metadata. User interaction is required, no privileges are needed, and the attack is network-reachable through any channel that delivers terminal output.

bash

# Patch: replace runtime-generated session ID with a token
# injected by Warp at shell integration setup time

# Before (vulnerable):
WARP_SESSION_ID="$(command -p date +%s)$RANDOM"

# After (fixed):
WARP_SESSION_ID=@@WARP_SESSION_ID@@

Source: warpdotdev/warp commit 32d21d1

rust

// Handler-side validation gate added in the fix
/// Returns whether DCS hooks should require a registered session ID.
fn should_validate_dcs_hook_session_id(&self) -> bool {
    true
}

/// Validates that a hook's session_id is recognized. Returns `true` if the
/// hook should be processed, `false` if it should be rejected.
fn validate_hook_session_id(&mut self, hook: &DProtoHook) -> bool {
    if !hook.requires_registered_session()
        || !self.handler.should_validate_dcs_hook_session_id()
    {
        return true;
    }
    // ...
}

Source: warpdotdev/warp commit 51bd326

Detection Methods for CVE-2026-54686

Indicators of Compromise

Terminal output containing unexpected DCS escape sequences (ESC P ... ESC \) carrying JSON payloads with "hook" keys such as InitShell, CommandFinished, or working directory updates.
Warp blocks displaying a working directory that does not match the actual shell pwd output.
SSH session indicators in Warp that do not correspond to a user-initiated ssh invocation.

Detection Strategies

Inspect captured PTY streams or script(1) recordings for DCS hook payloads emitted by processes other than the Warp shell integration.
Audit endpoints for Warp versions older than 0.2026.05.06.15.42.stable_01 using software inventory data.
Hunt for processes that write directly to a controlling TTY shortly before a working-directory change appears in user activity logs.

Monitoring Recommendations

Track Warp client version distribution across developer endpoints and alert on outdated builds.
Monitor execution of commands that render untrusted content (cat, less, curl, tail) immediately followed by privileged operations in the same Warp block.
Log SSH session establishment from endpoints and correlate against Warp's reported SSH transport metadata for inconsistencies.

How to Mitigate CVE-2026-54686

Immediate Actions Required

Upgrade Warp to version 0.2026.05.06.15.42.stable_01 or later on all developer workstations.
Avoid rendering untrusted output (logs, files, network responses) directly in Warp until upgrade is complete.
Re-initialize shell sessions after upgrading so the patched shell integration injects a Warp-controlled WARP_SESSION_ID.

Patch Information

The fix is delivered in Warp 0.2026.05.06.15.42.stable_01. Two changes implement the fix. First, the shell init scripts (bash_init_shell.sh, bash_init_subshell.sh) replace the locally generated WARP_SESSION_ID with a placeholder @@WARP_SESSION_ID@@ that Warp substitutes at integration time. Second, the ANSI handler (app/src/terminal/model/ansi/) now calls validate_hook_session_id against should_validate_dcs_hook_session_id, rejecting hooks that do not carry a registered session ID. See the GitHub Security Advisory GHSA-9w2v-jhww-vm85 for full details.

Workarounds

Pipe untrusted content through a sanitizer that strips DCS sequences, for example cat file | tr -d '\033' or less -R with escape filtering disabled.
Use a non-Warp terminal for viewing untrusted remote output until the patched version is deployed.
Restrict SSH from Warp into untrusted hosts, since attacker-controlled remote output is a primary delivery vector.